Terms of Service

1.1 About Crucibel and NOVA

Crucibel Technology Ltd. ("Crucibel", "we", "us", or "our") is a technology company incorporated under the Companies Act 2015 and registered in the Republic of Kenya. Crucibel develops and operates NOVA, a cloud-based Health Information Exchange (HIE) and Health Management Information System (HMIS) delivered as a Software-as-a-Service (SaaS) platform ("NOVA" or the "Platform") to healthcare organisations, government health agencies and related entities operating in Kenya.

NOVA enables the collection, storage, processing, exchange and analysis of health data across the healthcare continuum, including electronic medical records, laboratory results, immunisation data, pharmacy records, public health surveillance data and related health management information.

1.2 Agreement

These Terms of Service ("Terms") govern access to and use of the NOVA Platform by any organisation, institution, agency, or entity ("Client", "you", or "your") that registers for, is granted access to, or uses NOVA under any subscription or service arrangement with Crucibel.

These Terms apply to:

• All Client organisations and their authorised users accessing NOVA
• Access through any interface, including web browsers, mobile applications, APIs and integration endpoints
• All modules and features of the NOVA Platform, including those in beta or preview release
• All health data and other data processed through NOVA by or on behalf of the Client

1.3 Related Documents

These Terms must be read together with the following documents, which are incorporated by reference:

• Crucibel Data Processing Agreement (DPA)
• Crucibel Health Data & Confidentiality Policy
• Crucibel Privacy Policy
• Service Order / Statement of Work
• Crucibel Acceptable Use Policy

In the event of conflict between these Terms and a signed Service Order, the Service Order shall prevail to the extent of the inconsistency.

3.1 Grant of Access

Subject to these Terms, timely payment of Fees and execution of a valid Service Order and DPA, Crucibel grants the Client a limited, non-exclusive, non-transferable, non-sublicensable right to access and use NOVA during the Subscription Term, solely for the Client's internal healthcare and health management purposes within Kenya.

3.2 Authorised Users

The Client is responsible for:

• Ensuring only Authorised Users access NOVA
• Assigning appropriate roles to each Authorised User consistent with their function
• Ensuring all Authorised Users complete mandatory NOVA training, including the data protection module, before being granted access
• Promptly deactivating accounts for departing staff
• Conducting periodic access reviews — at minimum every six months

3.3 Account Security

The Client and its Authorised Users must:

• Maintain confidentiality of login credentials and never share credentials between users
• Use multi-factor authentication (MFA) as enforced by NOVA — MFA is mandatory and cannot be disabled
• Immediately notify Crucibel at security@crucibel.org upon any actual or suspected unauthorised account access

Crucibel shall not be liable for loss arising from the Client's failure to maintain account security.

3.4 System Administrator

The Client must designate at least one System Administrator responsible for managing user accounts, assigning roles and ensuring compliance at the Client's facility. The System Administrator must be notified to Crucibel at onboarding and updated promptly upon change.

3.5 Access Restrictions

The access rights granted under these Terms do not permit the Client to:

• Transfer, sublicense, or resell access to NOVA to any third party

4.1 Regulatory Compliance

The Client represents, warrants and undertakes that it shall, at all times during the Subscription Term:

• Hold all licences, permits and approvals required by Kenyan law to operate as a healthcare organisation and to process health data
• Comply with all applicable Kenyan laws, including the KDPA, Health Act 2017, HIV and AIDS Prevention and Control Act 2006, Mental Health Act 2022, Children Act 2022 and Computer Misuse and Cybercrimes Act 2018
• Maintain valid registration as a data controller with the ODPC
• Obtain all necessary patient consents before processing health data through NOVA

4.2 Data Controller Responsibilities

The Client is the data controller in respect of all Client Data processed through NOVA and is solely responsible for:

• Determining purposes and means of processing patient health data on NOVA
• Providing adequate privacy notices to patients in plain language and in Kiswahili where appropriate
• Responding to patient rights requests within KDPA timeframes
• Ensuring accuracy and integrity of all health data entered into NOVA
• Making all required notifications to the ODPC and affected patients regarding personal data breaches

4.3 Acceptable Use

The Client shall use NOVA only for lawful purposes. The Client shall not and shall ensure its Authorised Users do not:

• Upload or process data through NOVA without legal authority to do so
• Use NOVA to discriminate against any patient on the basis of health status, ethnicity, gender, religion, disability, or any other protected characteristic under Kenyan law
• Reverse-engineer, decompile, or attempt to derive the source code of NOVA
• Introduce malware, viruses, or malicious code into NOVA
• Circumvent, disable, or interfere with any security, access control, or audit feature of NOVA
• Use NOVA for commercial data brokerage, insurance risk scoring, employment screening, or any purpose incompatible with healthcare provision
• Allow any person who is not an Authorised User to access NOVA
• Use NOVA outside the territory of Kenya without Crucibel's prior written consent
• Integrate NOVA with any third-party system not approved in writing by Crucibel
• Use NOVA for any unlawful purpose or any purpose inconsistent with Kenyan health and data protection laws

4.4 Infrastructure and Training Obligations

The Client is responsible for providing adequate internet connectivity, compatible hardware, physical workstation security and ensuring all Authorised Users complete mandatory training before first access and annual refresher training thereafter.

5.1 Crucibel's Commitments

Crucibel shall during the Subscription Term: provide access to NOVA per these Terms and the Service Order; process Client Data only per the DPA and Health Data & Confidentiality Policy; implement and maintain appropriate security measures; provide support per the applicable SLA; and maintain valid ODPC registration as a data processor.

5.2 Platform Availability

Scheduled maintenance shall be conducted between 10:00 PM and 5:00 AM EAT with at least 48 hours' notice. Emergency maintenance may be performed without advance notice to protect platform security or integrity.

5.3 Support Services

5.4 Platform Updates

Crucibel may update NOVA at its discretion. Crucibel will provide at least 14 days' notice of material functional changes, maintain API backward compatibility for at least 12 months following any change and not remove core functionality without reasonable advance notice and a transition plan.

6.1 Ownership of Client Data

The Client retains full ownership of all Client Data at all times. Crucibel acquires no ownership rights in Client Data. Crucibel's right to process Client Data is limited to providing the NOVA service and performing obligations under these Terms and the DPA.

6.2 Data Processing Agreement

Crucibel processes health data as a data processor on behalf of the Client as data controller under the KDPA. A valid, executed DPA is a mandatory prerequisite to NOVA activation. Crucibel will not process Client Data except in accordance with the Client's documented instructions.

6.3 Data Security

Crucibel implements and maintains: AES-256 encryption at rest; TLS 1.3 for all data in transit; mandatory MFA; role-based and field-level access controls; immutable audit logging; annual third-party penetration testing; and ISO 27001-aligned information security management. No technology platform can guarantee absolute security; the Client is responsible for physical and procedural security at its facilities.

6.4 Data Location

NOVA stores Client Data on cloud infrastructure in Kenya or, where Kenyan infrastructure is unavailable for specific services, in jurisdictions subject to Transfer Impact Assessments consistent with the KDPA. Crucibel shall provide 30 days' notice of any material change to data hosting locations.

6.5 Data Return and Deletion

Upon termination, the Client may request export of all Client Data in HL7 FHIR-compliant format within 90 days. Crucibel will provide one export at no charge. Following the 90-day period, Crucibel will securely delete or anonymise Client Data and provide written confirmation of deletion upon request.

6.6 Aggregated and Anonymised Data

Crucibel may use aggregated, anonymised, de-identified data from which no individual patient can be identified for platform improvement, R&D and public health analytics. Such use is not subject to DPA restrictions. Crucibel shall ensure irreversibility of anonymisation before any such use.

7.1 Crucibel's Intellectual Property

NOVA and all its components — including software, algorithms, databases, data models, user interfaces, APIs, documentation, trademarks and service marks — are the exclusive intellectual property of Crucibel and its licensors. These Terms do not transfer any Intellectual Property Rights in NOVA to the Client. The Client acquires only the limited access right set out in Clause 3.1.

7.2 Client Data

All Intellectual Property Rights in Client Data belong to the Client and/or the patients concerned. The Client grants Crucibel a limited, non-exclusive licence to process Client Data solely to the extent necessary to provide NOVA and perform obligations under these Terms and the DPA.

7.3 Feedback

If the Client provides Feedback on NOVA, the Client grants Crucibel a perpetual, irrevocable, royalty-free licence to use such Feedback for any purpose, including incorporating it into NOVA, without obligation of confidentiality or compensation.

7.4 Restrictions

The Client shall not: copy, modify, or create derivative works of NOVA; reverse-engineer or decompile NOVA; remove proprietary notices; use Crucibel's name or trademarks without consent; or represent any derivative product as developed or endorsed by Crucibel.

8.1 Subscription Fees

The Client shall pay the Fees set out in the applicable Service Order. All Fees are quoted in Kenya Shillings (KES) unless otherwise specified and are exclusive of applicable taxes.

8.2 Taxes

All Fees are exclusive of VAT and any other taxes imposed by Kenyan law. The Client is responsible for all applicable taxes. Where Crucibel is required to collect VAT, it shall be added to invoices and the Client shall pay it.

8.3 Payment Terms

• Invoices payable within 30 days of invoice date unless otherwise specified in the Service Order
• Payment by bank transfer, M-Pesa Paybill, or other agreed method
• Fees are non-refundable except as expressly provided in these Terms or required by Kenyan law

8.4 Late Payment

For overdue undisputed invoices, Crucibel may charge interest at 2% per month (or CBK reference rate plus 5%, whichever is higher); suspend access after 14 days' notice where payment is more than 30 days overdue; or terminate after 60 days overdue. Suspension does not apply where a bona fide written dispute has been raised and is being actively resolved.

8.5 Fee Adjustments

Crucibel may adjust Fees at the start of each renewal term with at least 60 days' prior written notice. Fee adjustments during an active Subscription Term require the Client's written agreement.

9.1 Mutual Confidentiality Obligations

Each party agrees to: keep confidential all Confidential Information received from the other; use it only for performing obligations under these Terms; not disclose it to third parties without prior written consent; and apply at least reasonable care to protect it.

9.2 Exceptions

Confidentiality obligations do not apply to information that: is publicly available through no breach; was known before disclosure; is independently developed; or is required to be disclosed by Kenyan law or court order — provided reasonable advance notice is given where lawfully permitted.

9.3 Health Data

All Client Data, including patient health data, is Confidential Information subject to additional protections under the DPA and Health Data & Confidentiality Policy. These obligations are in addition to and do not limit, Crucibel's obligations as data processor under the DPA and KDPA.

9.4 Survival

Confidentiality obligations survive termination for five (5) years, except for trade secrets and patient health data, where they survive indefinitely.

10.1 Crucibel's Warranties

Crucibel warrants that: NOVA will perform materially per its Documentation; the service will be provided with reasonable skill and care; NOVA does not infringe third-party Intellectual Property Rights in Kenya; and Crucibel will comply with all applicable Kenyan laws.

10.2 Client's Warranties

The Client represents and warrants that: it has authority to enter into these Terms; it holds all required healthcare licences and registrations in Kenya; all information provided to Crucibel is accurate; it will use NOVA lawfully; and it will obtain all required patient consents.

10.3 Disclaimer

11.1 Limitation of Liability

Crucibel shall not be liable for: loss of profits, revenue, or anticipated savings; loss of business or contracts; loss or corruption of data; indirect or consequential loss; or any clinical outcome or patient harm arising from clinical decisions made by healthcare professionals using NOVA.

11.2 Exceptions to Limitation

Nothing limits liability for: death or personal injury caused by Crucibel's negligence; fraud or fraudulent misrepresentation; any liability that cannot be excluded under Kenyan law; or Crucibel's material breach of its DPA obligations directly causing a notifiable personal data breach.

11.3 Client Indemnification

The Client shall indemnify Crucibel and its directors, officers and staff from claims arising from: the Client's breach of these Terms, the DPA, or Kenyan law; negligent or unlawful use of NOVA; failure to obtain patient consents; or any patient claim arising from the Client's unlawful data processing through NOVA.

11.4 Mitigation

Each party has a duty to take reasonable steps to mitigate any loss or damage suffered. Failure to mitigate may reduce recoverable losses.

12.1 Grounds for Suspension

Fee obligations continue during suspension except where Crucibel suspended access solely due to its own breach.

13.1 Subscription Term

These Terms commence on the date the Client first accesses NOVA (or the Service Order date, whichever is earlier) and continue for the Subscription Term. Unless either party gives 60 days' notice of non-renewal, the agreement automatically renews for successive terms of the same duration.

13.2 Termination for Cause

Either party may terminate with immediate effect by written notice if: the other commits a material breach unremedied within 30 days of written notice; the other becomes insolvent; or the other commits fraud or misrepresentation.

Crucibel may terminate immediately (without the 30-day period) if: the Client commits an irremediable material breach of the DPA or data protection law; the Client's use of NOVA poses immediate and serious risk to patient safety or rights; or a regulatory authority directs termination.

13.3 Termination for Convenience

Either party may terminate for convenience by providing 90 days' written notice. No refund of prepaid Fees is due for Client convenience termination during a Subscription Term unless otherwise agreed in the Service Order.

13.4 Effect of Termination

Upon termination: all access rights immediately cease; the Client must cease all use of NOVA and delete credentials; Crucibel provides data export assistance per Clause 6.5; all outstanding Fees become immediately payable; and survival clauses (Clauses 6, 7, 9, 11, 14, 15) continue in force.